How this is calculated. Start at 110. Each requirement you mark Not met subtracts its weight — 5, 3 or 1 point. The 110 requirements carry 313 points in total, so if nothing is in place the score is -203, and if everything is in place it is 110.
Two requirements allow partial credit: 3.5.3 (multifactor authentication) and 3.13.11 (FIPS-validated cryptography) award 3 of 5 points when partially implemented. Requirements marked Not applicable keep their full points, but you should be able to justify why.
What this number means — and what it doesn't
The SPRS score is what you submit to the DoD after a NIST SP 800-171 self-assessment. It is a summary of your gap, not a certificate and not a compliance finding.
| It tells you | It does not tell you |
|---|---|
| How many points you are short | Whether your evidence would survive a C3PAO assessment |
| Which of the 14 families cost you the most | Whether a control is effectively implemented, only that you believe it is |
| Whether you are in the "months of work" range or the "weeks" range | That you are compliant. Only an assessment says that. |
If you are 20+ points short, most small contractors bring in help — not because they can't read the requirements, but because someone has to write the SSP and the POA&M.
Got a score and a gap list?
We can point you at a CMMC consultant who works with contractors your size — you keep the score, they close the gaps. No obligation, no sales calls unless you ask for one.
Talk to someoneQuestions contractors ask before they start
Do I need to submit my score to use this?
No. Nothing here is submitted anywhere. You calculate privately, then submit your final score yourself in the DoD's SPRS system when your self-assessment is signed.
Should I mark something "Implemented" if it's mostly done?
No. The methodology is binary: a requirement is either met or not. Partial credit exists only for two requirements (3.5.3 and 3.13.11). Marking "mostly done" as met inflates your score and creates a much bigger problem during an assessment.
What if a requirement genuinely doesn't apply?
You can mark it Not applicable and keep the points, but you need a documented justification. The five requirements most often marked N/A are 3.1.12, 3.1.13, 3.1.16, 3.1.17 and 3.1.18 — all tied to remote access and wireless.
My score is negative. Is that normal?
Yes, at the start. A contractor who has documented nothing scores -203. The number is a snapshot of how much evidence exists, not a judgment about your security.
How often does it need to be redone?
A self-assessment older than three years is no longer considered current. Most contractors re-run it annually and whenever the system boundary changes.
Next: the 110-point checklist, the Level 2 guide, or software that tracks this for you.